/**
 * kubectl-context.ts — shared kubectl-context resolver.
 *
 * Single source of truth for the D1 / SEC-NEW-003 context-resolution
 * policy. Extracted so `upgrade-kubernetes.ts`, `auth-refresh-kubernetes.ts`,
 * `services.ts`, and any future kubernetes-substrate consumer can call the
 * same helper instead of duplicating it.
 *
 * Policy (matches the pre-existing auth-refresh-kubernetes.ts and services.ts
 * behaviour — see also docs/architecture/peripheral-services-on-k3s.md):
 *
 *   1. `host.kubectl_context_pinned` in `~/.olam/config.json` (preferred,
 *      persistent — the doc-recommended way).
 *   2. `OLAM_K8S_CONTEXT_ACK` env var (deprecated fallback; emits a
 *      deprecation warning to nudge operators toward (1)).
 *   3. Both absent → error result with actionable remediation.
 *
 * No `fs` reads in this module beyond what `readConfig` does; no kubectl
 * invocations. Pure resolution. Safe to call from any layer.
 */
/**
 * Result shape mirrors `auth-refresh-kubernetes.ts`'s pre-existing public
 * `resolveKubectlContext` so callers there can be migrated without source
 * changes. Exactly one of `context` or `error` is set.
 */
export interface KubectlContextResolution {
    readonly context?: string;
    readonly deprecationWarning?: string;
    readonly error?: string;
}
/**
 * Resolve the operator's kubectl context name. See module docstring for policy.
 *
 * `configPath` lets callers (and tests) point at a non-default config file.
 * Returns a `KubectlContextResolution` — callers branch on `error` vs `context`.
 */
export declare function resolveKubectlContext(configPath?: string): KubectlContextResolution;
//# sourceMappingURL=kubectl-context.d.ts.map